4bec8bdf7715aa0d0372efd1821a72dbbeae1ec331a7b3e5f73d25bcbb56658b

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_4bec8bdf7715aa0d0372efd1821a72dbbeae1ec331a7b3e5f73d25bcbb56658b.exe
Size 769KB
Sample261002-kbdzzastdv
SHA256 4bec8bdf7715aa0d0372efd1821a72dbbeae1ec331a7b3e5f73d25bcbb56658b
MD5 cf81c8a6ef43ad9c96bc026da6f3ad14
SHA1 1107e9f23183fa2dc100e99e3879b32020b0a41f
SHA512 342af2bbf67567dfff49437513acde26b8e6572af10ad92cb2cf5624a2215961986dc8ac23189f620edca4136617d90a561f86c0f12df359fb7ef7deae59e96d
SSDEEP 12288:7aWzgMg7v3qnCiMErQohh0F4CCJ8lnyC8VImV6biHKy5S:OaHMv6CorjqnyC8VI3bRy4
TLSH
T1A1F4C012B7C680B6E9A33971297BE32BEB3575194337C4DB97E02E768F211409B36361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00170000000115b2-4.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
3328	Patch-2.exe
2960	Patch-2.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4260-0-0x0000000000400000-0x00000000004B0000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_4bec8bdf7715aa0d0372efd1821a72dbbeae1ec331a7b3e5f73d25bcbb56658b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Patch-2.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 3328	4260	jaffacakes118_4bec8bdf7715aa0d0372efd1821a72dbbeae1ec331a7b3e5f73d25bcbb56658b.exe	90
PID 4260 wrote to memory of 2960	4260	jaffacakes118_4bec8bdf7715aa0d0372efd1821a72dbbeae1ec331a7b3e5f73d25bcbb56658b.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4bec8bdf7715aa0d0372efd1821a72dbbeae1ec331a7b3e5f73d25bcbb56658b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4bec8bdf7715aa0d0372efd1821a72dbbeae1ec331a7b3e5f73d25bcbb56658b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\Patch-2.exe
  "C:\Users\Admin\AppData\Local\Temp\Patch-2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3328
- C:\Users\Admin\AppData\Local\Temp\Patch-2.exe
  "C:\Users\Admin\AppData\Local\Temp\Patch-2.exe"
  2⤵
  - Executes dropped EXE
  PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Patch-2.exe

Path C:\Users\Admin\AppData\Local\Temp\Patch-2.exe
Size 98KB
SHA256 a290b3c0ec4618c0f404c6012b7c94fd93857c9cf0c869776c6da18c41e67c30
MD5 becf4a578f36115feb84d1012bc0083a
SHA1 04a60c357654acc065cd9ac590807f31de358307
SHA512 374d3d8d8106bd7b9858e6d82330ea9a359eb43b4417c759e96053967085914e2c59ddd07c219c3a44a46b81d1032c102d44ded5c17ab3902725de3eabf5876b
SSDEEP 3072:6A/yVHnoTvh0BJGaTqSzFzYzFjcm/Qta4r:v6HotaTHxr
TLSH
T1C5A301269C07E1F1D06187B732814F11A839EB624DBB088A749E014E5FBA3599F8F3F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3328-10-0x0000000000400000-0x0000000000B78000-memory.dmp

Download

memory/4260-0-0x0000000000400000-0x00000000004B0000-memory.dmp